CreditEaseDBA / Themis

数据库审核平台
Apache License 2.0
346 stars 168 forks source link

mysql sqlplan审核没有mongodb权限 #19

Closed bqwzhl20 closed 6 years ago

bqwzhl20 commented 6 years ago
settings.py里面mongodb配置如下,有密码的,其中sqlreview用户是在admin用下创建的有root权限,但进行mysql sqlplan审核时报没有mongodb权限。

----------------------------------------------------建用户语句如下--------------------------------------- use admin db.createUser( { user: 'sqlreview', pwd: 'xxxxxx', roles: [{role: 'root',db: 'admin'}] } ) ----------------------------------------------------配置如下--------------------------------------------- MONGO_SERVER = "127.0.0.1" MONGO_PORT = 27017 MONGO_USER = "sqlreview" MONGO_PASSWORD = "xxxxxx" MONGO_DB = "sqlreview"

----------------------------------------------------错误如下--------------------------------------------- ----------------------------------------------------错误如下--------------------------------------------- [2017-12-06 18:39:09,036: ERROR/MainProcess] Task task_other.analysis[73138417-b0ff-4be2-8e07-b429a118b813] raised unexpected: OperationFailure(u' command SON([(\'eval\', u\'db.planitem.find({"schemas":"sakila","access_type" : "fulltext"}).forEach(function(x){db.sqlinfo.find({checksum:x.check sum}).forEach(function(y){db.tmphpl.save({"checksum" :y.checksum,"ts_cnt" :y.ts_cnt,"query_time_avg" :y.query_time_avg,"rows_sent_avg" :y.rows_sen t_avg,"index_ratio" :y.index_ratio})})})\')]) on namespace sqlreview.$cmd failed: not authorized on sqlreview to execute command { eval: "db.plani tem.find({"schemas":"sakila","access_type" : "fulltext"}).forEach(function(x){db.sqlinfo.find({checksum:x.checksum}).forEach(function(y){db.tm..." }',) Traceback (most recent call last): File "/home/themis-test/python-project/lib/python2.7/site-packages/celery/app/trace.py", line 240, in trace_task R = retval = fun(*args, *kwargs) File "/home/themis-test/python-project/lib/python2.7/site-packages/celery/app/trace.py", line 438, in __protected_call__ return self.run(args, kwargs) File "/home/themis-test/themis/task_other.py", line 15, in analysis command.run_analysis(args) File "/home/themis-test/themis/command.py", line 214, in run_analysis job_record = themis.run(job_args) File "/home/themis-test/themis/rule_analysis/themis.py", line 285, in run hostname, user, passwd) File "/home/themis-test/themis/rule_analysis/themis.py", line 140, in m_rule_parse self.mongo_client.command(rule_cmd) File "/home/themis-test/themis/rule_analysis/db/mongo_operat.py", line 43, in command self.db.command("eval", rule_cmd, nolock) File "/home/themis-test/python-project/lib/python2.7/site-packages/pymongo/database.py", line 481, in command codec_options, kwargs) File "/home/themis-test/python-project/lib/python2.7/site-packages/pymongo/database.py", line 393, in _command allowable_errors) File "/home/themis-test/python-project/lib/python2.7/site-packages/pymongo/pool.py", line 213, in command read_concern) File "/home/themis-test/python-project/lib/python2.7/site-packages/pymongo/network.py", line 101, in command helpers._check_command_response(response_doc, msg, allowable_errors) File "/home/themis-test/python-project/lib/python2.7/site-packages/pymongo/helpers.py", line 196, in _check_command_response ▽ raise OperationFailure(msg % errmsg, code, response) OperationFailure: command SON([('eval', u'db.planitem.find({"schemas":"sakila","access_type" : "fulltext"}).forEach(function(x){db.sqlinfo.find({c hecksum:x.checksum}).forEach(function(y){db.tmphpl.save({"checksum" :y.checksum,"ts_cnt" :y.ts_cnt,"query_time_avg" :y.query_time_avg,"rows_sent_a vg" :y.rows_sent_avg,"index_ratio" :y.index_ratio})})})')]) on namespace sqlreview.$cmd failed: not authorized on sqlreview to execute command { e val: "db.planitem.find({"schemas":"sakila","access_type" : "fulltext"}).forEach(function(x){db.sqlinfo.find({checksum:x.checksum}).forEach(functio n(y){db.tm..." }

tuteng commented 6 years ago

看着不像是权限的问题 可以参考这里 https://github.com/mongodb/mongo-python-driver 用你新建的账号去测试一下连接操作是否正常

bqwzhl20 commented 6 years ago

rule_analysis/db/mongo_operat.py: self.conn.admin.authenticate(account, password) 改为 rule_analysis/db/mongo_operat.py: self.conn.admin.authenticate(account, password, dbname) 这里面的dbname相当于mongo命令行的authenticationDatabase选项